JP2007274668A - Method and device for authorizing conditional access - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent occurrence of long periods in which encrypted digital data product cannot be accessed. <P>SOLUTION: The invention includes a step, in a first mode, for returning at least one control word in response to an entitlement control message including a product identifier if the product identifier corresponds to a product identifier in a stored entitlement including expiry information indicating the entitlement to be valid, and a step, in a second mode, for progressively adjusting a counter to a predetermined value and returning at least one control word in response also to the entitlement control message including the product identifier if the counter is at a value between an initial value and the predetermined value. The counter is set to the initial value to commence operation in the second mode upon receiving the entitlement control message including the product identifier corresponding to the product identifier in the stored entitlement that includes the expiry information indicating the expiry of the entitlement. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

The present invention relates to a method for authorizing conditional access to an encrypted digital data product, the method comprising:
Storing at least one set of rights, each including a product identifier and expiration information, in a safety device;
Receiving a rights control message, each including a product identifier, from a decoder system including an apparatus for decrypting the digital data product encrypted using the control word;
In a first mode, if the product identifier matches a product identifier in the stored right that includes expiration information indicating that the right is valid, in response to a rights control message that includes the product identifier. Returning at least one control word;
In the second mode, the product identifier matches a product identifier in the stored right that includes expiration information indicating expiration of the right, and the counter is between an initial value and a predetermined value If it is a value, the method includes progressively incrementing or decrementing the counter to a predetermined value and returning at least one control word in response to a rights control message that also includes a product identifier.

The present invention also relates to a system for authorizing conditional access to encrypted digital data products, the system comprising:
An authorization device having a secure memory for storing at least one set of rights, each including a product identifier and expiration information, and an interface to a decoder system that includes a device for decrypting the encrypted digital data product The interface allows the authorization device to receive a rights control message including a respective product identifier;
The authorization device is configured to operate in at least one of a first and second mode;
In the first mode, if the product identifier matches the product identifier in the stored right, including expiration information indicating that the right is valid, the authorization device is received through the interface and the product In response to a rights control message including an identifier, returning at least one control word;
In the second mode, the product identifier matches a product identifier in the stored right that includes expiration information indicating expiration of the right, and the counter is between an initial value and a predetermined value If it is a value, the authorizing device progressively increments or decrements the counter to a predetermined value and again receives at least one control word in response to a rights control message received through the interface and including a product identifier. return.

  The invention also relates to a digital message.

  The invention also relates to a computer program.

A specific example of such a method and system is known from EP-A1-1 094 667. That document describes how to operate a conditional access system for broadcast applications. The conditional access system has many subscribers, each having a terminal with a conditional access module and a security device for storing rights. Each right represents a service that is visible to the subscriber receiving the right. A rights management message (EMM) is sent to a safety device or group of safety devices, each providing a right and a corresponding expiration date. Rights are periodically refreshed according to their expiration date by sending an EMM that updates the expiration date. Expiration of rights due to not receiving the refreshment EMM is prevented by sending a set of extended EMMs to the entire base of the safety device. Each extended EMM remains valid for the safety device for a predetermined second period, with all rights having an expiration date within a predetermined first period, ie within a certain number of days. Inform them of the possibility. Thus, all smart card rights are extended during the second period.
European Patent Application Publication No. 1 094 667

  The problem with the known method is that if the subscriber's equipment is switched off for a relatively long time, it is not very suitable for the purpose of preventing "blackout". Since EMMs, including extended EMMs, are sent relatively infrequently, a terminal that has been switched off for a long time can only be turned on and after it has been turned on for a relatively long time. If the first period has not passed, it begins to decode the broadcast signal to receive a refreshment EMM or an extended EMM. This challenge became more serious when broadcast services for mobile phone handsets began to be deployed. Because these devices are often left off for a relatively long time to save battery power.

  The object of the present invention is to prevent the occurrence of long periods of inability to access encrypted digital data products due to expired rights that could not be updated on time. A method, system, digital message and computer program are provided.

  This object is achieved by a method according to the invention, which, upon receiving a rights control message containing a product identifier that matches the product identifier in the stored rights, includes expiration information indicating the expiration of the right. Is set to an initial value, and the operation in the second mode is started.

  A safety device is a device with a function that prevents tampering and / or makes tampering evident, and this function can be realized in software or hardware. As described above, the safety device has a function of preventing unauthorized persons from changing data stored therein. The expiration information may only indicate an expiration or validity indication given by the point in time, ie the relationship of the point in time to the current time or date as indicated by the safety device or a timing system in the decoder system. In that case, the expiration information indicating that the right is valid corresponds to a display at a future time.

  Since the operation in the second mode begins upon receipt of a rights control message, any blackout will last as long as normal. This is because the start of decryption is always delayed until the decoder system receives a control word from the authorizing device in response to the initial rights control message. A product identifier that matches the product identifier in the stored right, including expiration information indicating that the right has expired, causes a change to the second mode of operation. Thus, the counter is only initialized when needed. It is progressively added or subtracted, i.e. incremented or decremented towards a predetermined value, and the control word is only supplied if the counter is between the initial value and the predetermined value. Therefore, the extension of the expired right is only for a limited period of use. Therefore, conditional access cannot be avoided in the long run.

  In one embodiment, the initial value is based on a value stored in the safety device.

  Thus, the effectiveness of the second mode of operation does not depend on receiving a specific message within a specific period. The initial value defines the length of the grace period, and the grace period can be started even if external communication has not been received for a long period of time.

  In one embodiment, the initial value is stored in the safety device and searches for data indicating multiple decoder modes, and if such data is found, the initial value is a multiple derived from such data. And multiplying by

  In this way, a longer grace period is expected for safety devices that are authorized to operate in multiple decoder modes. Such an apparatus is suitable for connection to a personal video recorder having an answering machine recording function or an integrated receiver decoder.

  In one embodiment, the counter is incremented or decremented by a predetermined amount with each control word returned in the second mode.

  This embodiment takes into account the so-called non-page lock mode of operation that occurs at the integrated receiver decoder when looking for the correct stream of rights control messages (ECM). In such a mode, the safety device is equipped with many different ECMs until it begins to return a control word. A feature of the method described above is that it prevents the counter from reaching a predetermined value too quickly in non-page lock mode.

  In one embodiment, the operation in the second mode is initiated only when it is determined that each of the rights in the stored set of rights includes expiration information indicating the expiration of the respective right.

  In this way, because the subscriber is no longer authorized to access the relevant product, the situation where one right expires and the safety device could not receive updated expiration information, all The situation where the right of the user has expired is identified. Note that a safety device may store several sets of rights. For example, a smart card generally comprises a plurality of sectors. In the sense of this description, a right in one sector usually corresponds to a set of rights.

  In one embodiment, at least in the first and second modes, the expiration information contained in one right in the stored set of rights is updated in response to the first type of rights management message. , Identifying the product corresponding to the product identifier included in the right and transferred to the safety device by the decoder system.

  This limits the time spent in the second mode of operation. The counter value does not reach a predetermined value so quickly.

  In one embodiment, upon receipt of the second type of rights management message, the right is removed from the stored set of rights, included in the right, and transferred to the safety device by the decoder system. Identify the corresponding product.

  This prevents the second mode of operation from persisting if one right expires because the subscriber is no longer allowed to access the associated product.

  In one embodiment, the decoder system comprises a tuner for retrieving rights management messages on a particular communication channel, and the method provides a request to the decoder system after operation in the second mode begins. And setting the tuner to a specific communication channel.

  This ensures that there is sufficient time to receive any rights management message (EMM) that deletes or modifies the rights in the stored rights set. The time spent in the second mode is further limited.

  One embodiment switches from operating in the second mode to operating in the first mode if it is determined that each of the stored rights in the set includes expiration information indicating that the rights are valid. have.

  Therefore, the predetermined value of the counter is not reached so rapidly. Also, continuous operation is guaranteed. This is because when the counter reaches a predetermined value while belonging to the second mode, the supply of the control word is stopped.

  In one embodiment, the initial value is modified in response to a value obtained from a message forwarded to the safety device by the decoder system or a message stored in the safety device and forwarded to the safety device by the decoder system. Based on value.

  The message provides a means for reinitializing the initial value. This allows a potentially unlimited number of long periods of non-use of the safety device without the appearance of a blackout when use begins again.

  According to another aspect, the system according to the invention, when the authorization device receives a rights control message that includes a product identifier that matches the product identifier in the stored right, including expiration information indicating expiration of the right, Characterized by being configured to set the counter to an initial value and start operation in the second mode.

  The initial value may be based on a value stored in the safety device or a value included in the rights control message. Thus, while the rapid activation of decryption is guaranteed, the fact that safety device intervention is required ensures that access is still dependent on authorization.

  In one embodiment, the authorization device is configured to perform the method according to the present invention.

  One embodiment of the system carries information representing the new counter value to the authorizing device via a decoder system and a network link to the decoder system, such that the authorizing device is based on the initial value of the new counter value. A system is further provided for providing rights messages arranged in a format.

  This allows a potentially unlimited number of long periods of non-use of the safety device without the appearance of a blackout when use begins again.

  In another aspect of the invention there is provided a digital message transmitted over a data link from a server to at least one of a decoder system and an authorizing device, as provided in the definition of a system according to the invention, Represents a new counter value and carries information arranged in a format that prompts the authorizing device to be based on the initial value of the new counter value.

  In another aspect of the invention, when a computer program is incorporated into a machine-readable medium, a set of instructions capable of performing the method according to the invention by providing the system with information processing capabilities. Is included.

  The present invention will now be described in more detail with reference to the accompanying drawings.

  As an example, the headend system 1 shown in FIG. 1 is suitable for generating an encrypted digital data product and a rights message for decrypting the encrypted digital data product. In one embodiment, the encrypted digital data product is a file and comprises other information that implements a Digital Rights Management (DRM) system. Such information identifies the type of use, which may be made of an encrypted data product. The file can be recorded on a data carrier, such as an optical or magnetic disk. Alternatively, they can be downloaded by the receiver through a communication network, including, for example, a cellular mobile telephone network, a satellite network and / or a cable or terrestrial broadcast network. In another embodiment, as shown in FIG. 1, an encrypted digital data product includes a set of one or more digital data streams that are composed of digital data packets having a header and a payload. The header includes an identifier indicating the stream to which the related data packet belongs. In a common embodiment, used herein for convenience of description, a digital data product is a product that includes one or more MPEG-2 transport streams. The format of such a data stream is naturally known, for example from the international standard ISO / IEC 13818-1. An encrypted product that includes one or more streams of encrypted transport stream (TS) packets is unicast, multicast, or broadcast as a cellular mobile telephone network—in which case, for example, TS packets are Internet protocols Carried in (IP) packets—and provided to the receiver through any one or more of satellite, cable or terrestrial broadcast networks.

  The head end system 1 shown in FIG. 1 complies with the Simulcrypt standard for digital video broadcasting. A digital data stream belonging to the program and including one or more elementary streams of content data, for example video and audio components, is obtained from the storage system 2. A program in this context is a batch of data streams. Those of the data streams provided on a time basis have a common time base and are intended for synchronous display as indicated by the timing information in the elementary streams.

  The multiplexing system 3 performs time division multiplexing of the input data stream and supplies an MPEG-2 transport stream as output. An MPEG-2 transport stream is formed by a series of TS packets. The payload of each packet carries one or more units of data belonging to one elementary stream.

  In addition to the elementary stream from storage system 2, multiplexing system 3 receives program specific information (PSI) from PSI generator 4, receives a stream of rights control messages (ECM) from ECM generator 5, and EMM. A stream of rights management messages (EMM) is received from the generator 6. A conditional access provider (CA provider) operates a custom PSI generator 7 which provides program specific information to the PSI generator 4. Because of the presence of both PSI generator 4 and custom PSI generator 7, several other CA provider conditional access systems (not shown) are provided in headend system 1. Also good. The illustrated system associated with one CA provider's conditional access system comprises a custom PSI generator 7, an ECM generator 5 and an EMM generator 6.

  The headend system 1 further comprises a control word (CW) generator 8 that generates a series of encryption keys, referred to herein as control words. The network management system 9 controls the operation of various elements.

  The control word generated by the CW generator 8 is supplied to the synchronization system 10. The synchronization system 10 provides the control word to the ECM generator and receives the ECM instead. Each ECM includes at least a set of key information that enables the conditional access system authorizer to obtain a control word. The ECM is provided in a stream of separately identified TS packets in the multiplex generated by the multiplexing system. They are linked to the program they provide access by program specific information contained within the multiplex.

  The synchronization system 10 also supplies control words to the scramble system 11. The scramble system 11 scrambles at least a part of at least one specific payload in the MPEG-2 TS packet obtained as an output from the multiplexing system 3. One function performed by the synchronization system 10 is to synchronize the ECM stream with the scrambled MPEG-2 transport stream. Synchronization is performed in one embodiment by time stamps in MPEG-2 TS packets, thereby providing a common time base for TS packets carrying ECM and scrambled TS packets carrying content data. Synchronization can be accomplished by the order in which TS packets carrying ECM and their streams carrying scrambled content data are multiplexed in cooperation with a system for maintaining the order of TS packets in the multiplex. In other embodiments, the key message is used up over another channel, and the reference time is used to synchronize this stream of key messages with the stream of TS packets carrying scrambled content data. Is observed.

  In the illustrated embodiment, the ECM carries data that represents the control word and is encrypted under the session key. The ECM generator 5 obtains a session key from the EMM generator 6, which is a more accurate representation of the session key in a key-carrying EMM addressed to a subscriber or group of subscribers. For example, it contains an access token issued to the subscriber. All types of EMM described here are sent to the subscriber in an MPEG-2 transport stream generated by the multiplexing system 3 in a well-known manner.

  The scramble system 11 scrambles at least a part of the payload of the TS packet. Separate control word values are used for successive sections of the program corresponding to the control word period. The data in the ECM contains synchronization information and links the encrypted control word to the associated control word period so that the receiver has the correct control word value to decrypt a particular section of the program. Obtainable. This is also true for encrypted digital data products that contain files rather than data streams. The file can also be divided into an ordered sequence of sections, with successive ones encrypted under separate control word values.

  The multiplexing generated by the multiplexing system 3 includes a plurality of sets of streams corresponding to the respective programs. Each set of streams corresponding to a program is encrypted independently of the other programs and has its own sequence of ECMs. ECMs for different programs can be carried in one TS packet stream (ie, with packets having a common packet identifier in their headers). Each ECM carries a product identifier that is unique to the program and associated with the set of key information in the ECM, in addition to a set of key information that allows retrieval of the control word.

  FIG. 2 shows the subscriber equipment 12 including the receiver / decoder 13 in a very schematic manner. It should be understood that the systems and methods described herein are particularly amenable to implementation in a mobile device, eg, a subscriber unit included in a cellular telephone handset (not shown). This is because the subscriber device does not need to be constantly in a mode that receives data, especially EMM and ECM, from the headend. The effect is that battery power is saved in mobile devices.

  In the illustrated embodiment, the receiver / decoder 13 includes a network interface 14 and a tuner / demodulator 15 that implements a physical link to the headend system 1. This embodiment is suitable for transmission over satellite, cable or terrestrial broadcast links. In other embodiments, as mentioned, the link goes through a cellular telephone network. In that case, the physical interface to the network is different.

  The demultiplexer 16 filters TS packets belonging to the program when instructed by the processing unit 17. In a known manner, the program map table in the digital data stream obtained from the tuner / demodulator 15 contains the values of the corresponding packet identifiers in the headers of TS packets belonging to the program and ECM and EMM streams. It is out. Thus, EMM, ECM, and TS packets with at least partially scrambled payload are obtained.

  The receiver / decoder 13 comprises an interface 18 to an authorization device or access token in the form of a smart card 19. The smart card 19 is only an example of such an authorization device. In other embodiments, a combination of conditional access module and smart card is used. In another embodiment, the functionality of the smart card 19 is provided on the mobile phone handset's subscriber identity module (SIM) card sector. In yet another embodiment, the functionality of the smart card 19 is implemented in an access token that includes a software module executed by the processing unit 17 or other processor in the receiver / decoder 13. In such an embodiment, a code and / or data obfuscation technique is provided that allows the system having the executable code of the processing unit 17 and software modules to be secured against attempts to retrograde the code. Used. A separate physical authorization device may be implemented. In the usual case, additional protection hardware functions are provided to protect the memory and data processing unit of the authorization device, such as the processing unit 20 of the smart card 19 and the non-volatile memory 21 shown here as separate components. Provided.

  In the illustrated embodiment, the interface 18 of the receiver / decoder 13 cooperates with the interface 22 of the smart card 19 which is a separate portable authorization device.

  FIG. 3 shows an example of a method performed by the smart card 19 functioning as an authorization device in the conditional access system. The computer program code stored on the smart card 19 is configured so that the smart card 19 performs the illustrated method. The smart card 19 stores a right table 23 in its memory 21. Each entry in the table 23 corresponding to a right includes a product identifier and data representing a point in time, for example a date and optionally a time.

  Note that the smart card 19 may store several tables, such as the table 23 shown. This is a case where the smart card 19 has a plurality of sectors. Each table 23 thus forms a separate set of rights, each set usually belonging to a different CA provider.

  In the table 23, entries corresponding to the first type EMM are arranged. These EMMs are also generated by the EMM generator 6 of the conditional access system. They contain data representing product identifiers and associated expiration information. Upon receiving the second type of EMM that identifies the product involved and is transferred to the smart card 19 by the receiver / decoder 13, the rights are removed from the table 23. Similar to the EMM that carries the key, the processing unit 17 provides appropriate tuning commands to the tuner / demodulator and / or demultiplexer 16 to obtain the first and second types of EMM. The latter intervention is necessary. This is because EMMs are usually sent on separate channels (ie, in separately identified TS packet streams in the multiplex). In embodiments where the EMM is received from outside the band, other types of tuning commands are issued by the processing unit for other types of tuning devices (not shown).

  The first type of EMM, including the EMM that updates the expiration information contained in the rights already stored in the table 23, is sent to the receiver / decoder 13 at intervals longer than 15 minutes. Therefore, the receiver / decoder 13 must be switched on and tuned for a very long period of time to ensure that a complete update of the rights in the table 23 is obtained. If the subscriber unit 12 is only used in a short time interval, not all rights in the table 23 may be very updated. The CA provider can also choose to grant rights for a short period for security. This also increases the likelihood that one or more of the rights in the table 23 will expire before the first type of EMM for updating the rights is transferred to the smart card 19.

  Even if the rights to the program expire, the smart card 19 can execute a so-called grace period in order to allow continued access to the program. During the grace period, the smart card 19 operates in a mode referred to herein as the second operation mode in order to distinguish it from the first or normal operation mode.

  The detailed embodiment shown in FIG. 3, which is the method used by smart card 19, is only used here as an example. In the first step 24, the smart card 19 receives the ECM. The ECM is transferred by the receiver / decoder 13 to the smart card 19 via the interfaces 18 and 22. It includes a product identifier and at least a set of encrypted key information corresponding to a control word to be used by the descrambler 25 to decrypt a section of the program stream corresponding to the control word period. In a second step 26, the smart card 19 retrieves the product identifier from the ECM.

  In a third step 27, the smart card 19 checks whether there is a right in the table 23 that contains a matching product identifier. Regardless of whether the smart card 19 is operating in the first mode or the second mode, only if the product identifier in the ECM matches the product identifier in the rights in the table 23. The smart card 19 proceeds with the process of decoding and returning the control word in the ECM. Thus, if there is no such right, the method resumes at the first step 24 where the next ECM is received.

  If the right identified in the ECM is found, the smart card 19 at least checks the validity of the right. In the illustrated embodiment, the smart card 19 checks the validity of all the rights contained in the table 23 when the rights corresponding to at least the identified product expire. A validity check is performed in a fourth step 28. In one embodiment, the smart card 19 implements a real-time clock, and the expiration information included in each right indicates a point in time. Therefore, whether the expiration information indicates the expiration of the right or whether it is valid is determined by performing a comparison with the current time value obtained from the real-time clock. The In another embodiment, the current time is the time derived by smart card 19 from the time stamp in the ECM. In another embodiment, the expiration information is a counter, which is incremented or decremented by a predetermined amount by each received and processed ECM to decrypt the section of the product identified in the right. Generate a control word for

  In the illustrated embodiment, if the smart card 19 is in normal operating mode and the right to include a product identifier that matches the product identifier in the ECM has expired, but not all other rights have expired. The ECM is not further processed. The first step 24 is performed on the next ECM. On the other hand, if the smart card 19 is in the normal operation mode and the right including the product identifier that matches the product identifier in the ECM includes expiration information indicating that the right is valid, A step 29 of decrypting the key information set is executed, followed by a step 30 which returns to the descrambler 25 the clear control word in the message.

  In the illustrated embodiment, a right that includes a product identifier that matches a product identifier in the ECM includes expiration information indicating that the right has expired, and all other rights in the table 23 are similarly If it has expired, the smart card enters a second mode of operation. In other words, the grace period begins. Note that in another embodiment, the grace period already begins as long as the rights of the product identified in the ECM expire. In yet another embodiment, there may be a threshold for the number of rights that have expired, above which the smart card 19 begins operating in the second mode.

  In order to start the operation in the second mode, the counter 31 is set to an initial value (step 32). In one variation, the initial value is derived from the value encoded in the ECM received in the first step 24. In this embodiment, the ECM is thus used as a digital message for transmission from the headend system 1 to the smart card 19 and carries information representing a new counter value. The ECM is in a format suitable for the smart card 19 to encourage the initial value of the counter 31 to be based on the new counter value. In another embodiment, the initial value is based on a value stored in the memory 21 in the smart card 19. The value stored in the memory 21 is programmed by initializing the smart card 19. To avoid having to return the smart card 19, the value stored in the memory 21 is updated upon receipt of the third type of EMM. In one embodiment, a new value to replace the value stored in memory 21 is encoded in the EMM. In this way, the headend system 1 sends a digital data message in the form of a third type of EMM, causing the smart card 19 to replace the stored value with a new value.

  In some embodiments, the subscriber unit 12 has the ability to decrypt multiple programs at substantially the same time. These embodiments include a personal video recorder and set top box or digital television receiver with an answering machine recording function. If there is an appropriate right, ie the right to authorize access to multiple encrypted programs, one smart card 19 is used to authorize the decryption of each of these programs. In that case, the initial value is obtained by multiplication with an integer representing the number of products that can be decoded simultaneously.

  While the smart card is operating in the second mode, the smart card checks whether the counter 31 has a value between an initial value and a predetermined final value, for example 0 (step 33). . If so, the counter is incremented or decremented by a predetermined amount (step 34), and steps 35 and 36 are executed to decode the control word and return the decoded control word to the receiver / decoder 13. . Only when a control word is returned, the counter 31 is decremented. The effect is that the counter 31 does not reach the value 0 too quickly when the smart card operates in non-page lock mode. In non-page lock mode, the processing unit 17 of the receiver / decoder 13 does not filter the ECM retrieved by the demultiplexer 16 by product identifier, but provides an ECM that includes a different product identifier.

  Smart card 19 remains in the second mode of operation until all the rights contained in table 23 are deleted or new expiration information is provided indicating that the rights are valid. Then, when the third step 27 is executed, if it is determined that the expiration information in all the rights in the table indicates a right relating to validity, the smart card 19 starts from the second operation mode. The mode is switched to the first operation mode. Information representing the current value of the counter 31 is stored in the memory 21 (not explicitly shown in FIG. 3).

  In at least one embodiment, after initiating operation in the second mode, the smart card 19 is tuned to the receiver / decoder 13 to the channel (ie, the elementary stream) over which the second type of EMM is transmitted. Make a request to keep the state. In one embodiment, the request specifies a set of time or product identifiers to ensure that the receiver / decoder 13 remains tuned long enough. In another embodiment, at step 32 where the counter is set, an error message is returned to the receiver / decoder 13 and this error message is output on the user interface of the receiver / decoder 13. This output requests the user not to switch off the subscriber unit 12 for a period of time.

  Thus, it is ensured that the rights stored in the table 23 are updated while the smart card 19 continues to authorize the decryption of the product requested by the subscriber. That is, blackout is prevented. The associated effect is that calls to the help desk or subscriber management center to renew rights are avoided.

  The invention is not limited to the embodiments specifically described herein, but may vary within the scope of the appended claims. For example, when a digital data product is encrypted using an asymmetric cipher, the ECM includes a key that forms a key pair with the key used to encrypt the digital data product or a portion of the digital data product. The descrambler 25 may be provided in the smart card 19 or may be provided in a separate conditional access module that interfaces between the smart card 19 and the receiver / decoder 13. In an embodiment implementing a DRM system, the smart card 19 includes a product identifier and issues a decryption key in the digital rights management object in response to a request corresponding to the ECM. The digital rights management object includes a key corresponding to the control word in the embodiments described in detail herein.

Fig. 4 shows in a schematic way a headend system comprising components of a conditional access system. Fig. 2 shows in a schematic way a receiver / decoder combined with subsequent parts of a conditional access system. FIG. 6 is a flow chart illustrating a number of steps in a method for authorizing conditional access.

Explanation of symbols

13 Receiver / Decoder 19 Smart Card 21 Nonvolatile Memory 23 Table 25 Descrambler 31 Counter

Claims (15)

In a method for authorizing conditional access to an encrypted digital data product,
Storing at least one set of rights (23), each including a product identifier and expiration information, in a safety device (19, 21);
Receiving a rights control message, each comprising a product identifier, from a decoder system (13) comprising a device (25) for decrypting the digital data product encrypted using the control word;
In a first mode, if the product identifier matches a product identifier in the stored right that includes expiration information indicating that the right is valid, in response to a rights control message that includes the product identifier. Returning at least one control word;
In the second mode, the product identifier matches the product identifier in the stored right including expiration information indicating the expiration of the right, and the counter (31) is set to an initial value and a predetermined value. The counter (31) is progressively incremented or decremented to a predetermined value and returns at least one control word in response to a rights control message that also includes a product identifier. And
Upon receipt of a rights control message including a product identifier that matches the product identifier in the stored right, including expiration information indicating the expiration of the right, the counter (31) is set to an initial value and in the second mode Starting the operation.   2. Method according to claim 1, characterized in that the initial value is based on a value stored in a safety device (19, 21).   The initial value is stored in the safety device (19, 21) and searches for data indicating a plurality of decoder modes, and if such data is found, the initial value is a multiple derived from such data. 3. The method according to claim 1, wherein the method is obtained by multiplication.   4. The method according to claim 1, wherein the counter is incremented or decremented by a predetermined amount with each control word returned in the second mode.   The operation in the second mode is started only when it is determined that each of the rights in the stored rights set (23) includes expiration information indicating the expiration of the respective rights. The method according to any one of claims 1 to 4.   In at least the first and second modes, in response to the first type of rights management message, the expiration information contained in the rights in the stored rights set (23) is updated, and the rights 6. The product according to claim 1, characterized in that it identifies a product corresponding to a product identifier that is included in the decoder and transferred to the safety device (19) by the decoder system (13). The method described.   Upon receipt of the second type of rights management message, the rights are deleted from the stored rights set (23), included in the rights, and transferred to the safety device (19) by the decoder system (13). 7. A method according to any one of claims 1 to 6, characterized in that a product corresponding to a product identifier to be identified is identified.   The decoder system (13) comprises a tuner (15-17) for retrieving rights management messages on a particular communication channel, the method providing a request to the decoder system (13) to provide a second The method according to claim 1, further comprising the step of setting a tuner (15-17) for a specific communication channel after operation in the mode is started. .   If each of the stored rights in the set (23) is determined to contain expiration information indicating that the rights are valid, there is a step of switching from operation in the second mode to operation in the first mode. 9. A method according to any one of claims 1 to 8, characterized in that:   The initial value is a value obtained from a message transferred to the safety device (19) by the decoder system (13), or is stored in the safety device (19), and is stored in the safety device (19) by the decoder system (13). 10. A method according to any one of claims 1 to 9, characterized in that it is based on a value that is modified in response to a message forwarded to. In a system authorizing conditional access to encrypted digital data products,
A decoder system including a secure memory (21) for storing at least one set of rights (23), each including a product identifier and expiration information, and a device (25) for decrypting the encrypted digital data product And an authorization device (19) having an interface (22) to (13), said interface (22) enabling the authorization device (19) to receive a rights control message including a respective product identifier. ,
The authorization device (19) is configured to operate in at least one of the first and second modes;
In the first mode, if the product identifier matches the product identifier in the stored right, including expiration information indicating that the right is valid, the authorization device (19) sends the interface (22) In response to a rights control message received through and including a product identifier, returning at least one control word;
In the second mode, the authorization device (19) progressively increments or decrements the counter (31) to a predetermined value so that the product identifier includes expiration information indicating expiration of the right. Right control that is received through the interface (22) and includes the product identifier if it matches the product identifier in the counter and the counter (31) is a value between the initial value and the predetermined value. In response to the message, return at least one control word,
Upon receipt of the rights control message including the product identifier that matches the product identifier in the stored right, including the expiration information indicating the expiration of the right, the authorization device (19) sets the counter (31) to an initial value. And a system configured to start operation in the second mode.   12. System according to claim 11, characterized in that the authorization device (19) is configured to perform the method according to any one of claims 1 to 10.   Via the network link to the decoder system (13) and to the decoder system (13), the authorization device (19) is presented with a new counter value and the authorization device (19) is based on the initial value of the new counter value. 13. System according to claim 11 or 12, further comprising a system (6, 7) for supplying a rights message carrying information arranged in a format.   Digital for transmission on a data link from a server (1) to at least one of a decoder system (13) and an authorization device (19) according to any one of claims 11 to 13 A digital message characterized in that it carries information arranged in a format that represents a new counter value and causes the authorization device (19) to base the initial value on the new counter value in the message.   A computer comprising a set of instructions capable of causing a system having information processing capabilities to perform the method according to any one of claims 1 to 10 when incorporated in a machine-readable medium. program.

Images